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Claims 

What is claimed is: 

1 . A method for network-based scanning for potentially malicious content, 
comprising: 

(a) monitoring network communications over a network; 

(b) identifying potentially malicious content in the network communications; 

(c) quarantining the potentially malicious content of the network communications; 

(d) executing a pattern for testing the potentially malicious content network 
communications for malicious code; and 

(e) conditionally delivering the network communications over the network based on 
the testing. 

2. The method as recited in claim 1 , further comprising scanning the network 
communications for known malicious content. 

3. The method as recited in claim 1, wherein the malicious content includes a 
mass-mailer virus. 

4. The method as recited in claim 1, wherein content is identified as potentially 
malicious when a number of instances of the content in the network 
communications is greater than a predetermined value. 

5. The method as recited in claim 1 , wherein the network communications include 
electronic mail messages. 
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6. 


The method as recited in claim 5, wherein an electronic mail message is 




2 




identified as having potentially malicious content when a number of messages 




3 




having an identical subject line is greater than a predetermined value. 
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7. 


The method as recited in claim 1 , wherein the potentially malicious content is 




2 




quarantined until the potentially malicious content has been scanned with a 




3 




malicious code detection file received after the potentially malicious content. 
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8. 


The method as recited in claim 1, further comprising cleaning the potentially 




2 




malicious content if malicious code is found for disabling the malicious code. 
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9. 


A computer program product for network-based scanning for potentially 


y 


2 


malicious content, comprising: 


0 E 
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(a) 


computer code that monitors network communications over a network; 
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(b) 


computer code that identifies potentially malicious content in the network 




5 




communications; 


W 
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(c) 


computer code that quarantines the potentially malicious content of the network 




7 




communications; 
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(d) 


computer code that executes a pattern for testing the potentially malicious 




9 




content network communications for malicious code; and 
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(e) 


computer code that conditionally delivers the network communications over the 




11 




network based on the testing. 
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10. 


A system for network-based scanning for potentially malicious content, 




2 


comprising: 




3 


(a) 


logic that monitors network communications over a network; 




4 


(b) 


logic that identifies potentially malicious content in the network 




5 




communications; 
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(c) logic that quarantines the potentially malicious content of the network 
communications; 

(d) logic that executes a pattern for testing the potentially malicious content network 
communications for malicious code; and 

(e) logic that conditionally delivers the network communications over the network 
based on the testing. 

11. A method for network-based scanning for potentially malicious content, 
comprising: 

(a) monitoring network communications over a network; 

(b) identifying potentially malicious content in the network communications; 

(c) quarantining the potentially malicious content of the network communications; 
and 

(d) delivering the network communications over the network after a predetermined 
delay. 

12. The method as recited in claim 11, further comprising scanning the network 
communications for known malicious content. 

1 3 . The method as recited in claim 1 1 , wherein content is identified as potentially 
malicious when a number of instances of the content in the network 
communications is greater than a predetermined value. 

14. The method as recited in claim 1 1 > wherein the network communications include 
electronic mail messages. 
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15. The method as recited in claim 14, wherein an electronic mail message is 
identified as having potentially malicious content when a number of messages 
having an identical subject line is greater than a predetermined value. 

16. The method as recited in claim 1 1, wherein the delay is for allowing 
quarantining of the potentially malicious content until the potentially malicious 
content has been scanned with a malicious code detection file received after the 
potentially malicious content. 

17. A method for network-based scanning for potentially malicious content, 
comprising: 

(a) monitoring network communications over a network; 

(b) identifying potentially malicious content in the network communications; 

(c) quarantining the potentially malicious content of the network communications; 
and 

(d) delivering the network communications over the network in response to a 
request from a user. 

18. The method as recited in claim 17, wherein the user is an intended recipient of 
the quarantined network communications. 

19. The method as recited in claim 17, further comprising scanning the network 
communications for known malicious content. 

20. The method as recited in claim 17, wherein content is identified as potentially 
malicious when a number of instances of the content in the network 
communications is greater than a predetermined value. 
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21. 


The method as recited in claim 17, wherein the network communications include 




2 




electronic mail messages. 
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22. 


The method as recited in claim 21, wherein an electronic mail message is 




2 




identified as having potentially malicious content when a number of messages 




3 




having an identical subject line is greater than a predetermined value. 
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23. 


A method for network-based scanning for potentially malicious content, 




2 


comprising: 




3 


(a) 


monitoring incoming and outgoing network communications over a network at a 


u 
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gateway; 


m 
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(b) 


scanning the network communications for known malicious content; 
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(c) 


identifying potentially malicious content in the network communications; 
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(d) 


wherein content is identified as potentially malicious when a number of identical 
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instances of the content in the network communications passing through the 
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network for a given period of time is greater than a predetermined value; 
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(e) 


wherein the network communications include electronic mail messages, wherein 
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an electronic mail message is identified as having potentially malicious content 




12 




when a number of messages having an identical subject line passing through the 
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network for a given period of time is greater than a predetermined value; 
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(0 


quarantining the potentially malicious content of the network communications; 
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(g) 


delivering the network communications over the network upon occurrence of the 
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first of: 
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(i) scanning the potentially malicious content with a malicious code 
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detection file received after the potentially malicious content is 
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received; 
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(ii) upon receiving a user request; 
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(iii) upon passage of a predetermined amount of time; 
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22 (h) notifying an intended recipient of the potentially malicious content that the 

23 potentially malicious content has been quarantined; 

24 (i) notifying a sender of the potentially malicious content that the potentially 

25 malicious content has been quarantined; and 

26 (j) cleaning the potentially malicious content if malicious code is found for 

27 disabling the malicious code. 
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